diff --git a/Cargo.lock b/Cargo.lock
index dda9d8fa..a1f8f011 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2054,12 +2054,6 @@ version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "05da548ad6865900e60eaba7f589cc0783590a92e940c26953ff81ddbab2d677"
 
-[[package]]
-name = "podio"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b18befed8bc2b61abc79a457295e7e838417326da1586050b919414073977f19"
-
 [[package]]
 name = "ppv-lite86"
 version = "0.2.8"
@@ -2760,6 +2754,26 @@ dependencies = [
  "unicode-width",
 ]
 
+[[package]]
+name = "thiserror"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0f4a65597094d4483ddaed134f409b2cb7c1beccf25201a9f73c719254fa98e"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7765189610d8241a44529806d6fd1f2e0a08734313a35d5b3a556f92b381f3c0"
+dependencies = [
+ "proc-macro2 1.0.24",
+ "quote 1.0.7",
+ "syn 1.0.60",
+]
+
 [[package]]
 name = "thread-id"
 version = "3.3.0"
@@ -3295,10 +3309,11 @@ dependencies = [
 
 [[package]]
 name = "zip"
-version = "0.5.5"
+version = "0.5.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6df134e83b8f0f8153a094c7b0fd79dfebe437f1d76e7715afa18ed95ebe2fd7"
+checksum = "8264fcea9b7a036a4a5103d7153e988dbc2ebbafb34f68a3c2d404b6b82d74b6"
 dependencies = [
+ "byteorder",
  "crc32fast",
- "podio",
+ "thiserror",
 ]
diff --git a/util/Cargo.toml b/util/Cargo.toml
index 7fb61636..e7298179 100644
--- a/util/Cargo.toml
+++ b/util/Cargo.toml
@@ -20,7 +20,7 @@ serde_derive = "1"
 log4rs = { version = "0.12", features = ["rolling_file_appender", "compound_policy", "size_trigger", "fixed_window_roller"] }
 log = "0.4"
 walkdir = "2"
-zip = { version = "0.5", default-features = false }
+zip = { version = "0.5.11", default-features = false }
 parking_lot = "0.10"
 zeroize = { version = "1.1", features =["zeroize_derive"] }
 
diff --git a/util/src/zip.rs b/util/src/zip.rs
index ce75078d..967738ef 100644
--- a/util/src/zip.rs
+++ b/util/src/zip.rs
@@ -21,6 +21,21 @@ use std::thread;
 use self::zip_rs::write::FileOptions;
 use zip as zip_rs;
 
+// Sanitize file path for normal components, excluding '/', '..', and '.'
+// From private function in zip crate
+fn path_to_string(path: &std::path::Path) -> String {
+    let mut path_str = String::new();
+    for component in path.components() {
+        if let std::path::Component::Normal(os_str) = component {
+            if !path_str.is_empty() {
+                path_str.push('/');
+            }
+            path_str.push_str(&*os_str.to_string_lossy());
+        }
+    }
+    path_str
+}
+
 /// Create a zip archive from source dir and list of relative file paths.
 /// Permissions are set to 644 by default.
 pub fn create_zip(dst_file: &File, src_dir: &Path, files: Vec<PathBuf>) -> io::Result<()> {
@@ -37,7 +52,7 @@ pub fn create_zip(dst_file: &File, src_dir: &Path, files: Vec<PathBuf>) -> io::R
 		let file_path = src_dir.join(x);
 		if let Ok(file) = File::open(file_path.clone()) {
 			info!("compress: {:?} -> {:?}", file_path, x);
-			writer.get_mut().start_file_from_path(x, options)?;
+			writer.get_mut().start_file(path_to_string(x), options)?;
 			io::copy(&mut BufReader::new(file), &mut writer)?;
 			// Flush the BufWriter after each file so we start then next one correctly.
 			writer.flush()?;
@@ -57,7 +72,7 @@ pub fn extract_files(from_archive: File, dest: &Path, files: Vec<PathBuf>) -> io
 		let mut archive = zip_rs::ZipArchive::new(from_archive).expect("archive file exists");
 		for x in files {
 			if let Ok(file) = archive.by_name(x.to_str().expect("valid path")) {
-				let path = dest.join(file.sanitized_name());
+				let path = dest.join(file.mangled_name());
 				let parent_dir = path.parent().expect("valid parent dir");
 				fs::create_dir_all(&parent_dir).expect("create parent dir");
 				let outfile = fs::File::create(&path).expect("file created");